OCT 助手

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:08 PM UTC
• Version: 1.0.0

Overview

The skill is only a short guide, but it points users to a powerful third-party desktop app without enough verification or safety boundaries.

Review before installing. Only install OCT if you trust the publisher and release channel, verify the downloaded app independently where possible, and avoid granting administrative privileges. Be cautious with prompts that modify files, run terminal commands, change system settings, or operate on Git repositories until the app provides clear confirmation and rollback behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Installation of Unverified Third-Party Executables

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-30
Vulnerability Type: Third-party software supply-chain risk
Risk Level: Medium

Vulnerable Code Snippet

markdown

### 方式 1：通过 ClawHub 安装

```bash
clawhub install oct-helper

方式 2：下载 OCT 桌面应用

GitHub Release: https://github.com/zl585451/openclaw-terminal/releases/tag/v0.1.2

text

### Technical Analysis

The Skill instructs users to install a ClawHub package or download and execute platform-specific desktop binaries from a third-party GitHub repository. It does not provide cryptographic checksums, digital signatures, an expected publisher identity, reproducible-build information, or verification instructions.

The document itself does not automatically retrieve or execute a payload, and the reviewed project contains no executable scripts. There is therefore no evidence that the referenced artifacts are malicious. However, users must trust the package registry, repository owner, release process, and hosted binaries without an independent integrity check.

This creates a supply-chain exposure: if the package, release artifacts, repository account, or distribution infrastructure were compromised, the installation instructions could lead users to execute substituted code.

### Attack Path

1. An attacker compromises the referenced ClawHub package, GitHub maintainer account, release workflow, or artifact-hosting channel.
2. The attacker publishes a modified package or replaces a platform-specific installer with a malicious artifact.
3. A user follows the instructions in `SKILL.md` and downloads or installs the artifact.
4. Because no checksum or signature verification is required, the substituted artifact is accepted without detecting the modification.
5. The user launches the installed application, executing attacker-controlled code under the user's desktop account.

### Impact Assessment

Successful exploitation could provide attacker-controlled code with the privileges of t
...[truncated 621 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish SHA-256 or stronger cryptographic hashes for every platform-specific release artifact.
2. Digitally sign release artifacts and document the expected signer identity, certificate fingerprint, or public signing key.
3. Add platform-specific verification commands that users must run before installation.
4. Pin the ClawHub installation command to a reviewed version rather than relying on an implicitly mutable package release.
5. Use a verified organization or publisher account for package and binary distribution.
6. Protect repository and registry publisher accounts with phishing-resistant multi-factor authentication and restricted release permissions.
7. Generate releases through a hardened CI pipeline with provenance attestations and auditable build logs.
8. Document the permissions the application requires and advise users not to install or run it with administrative privileges unless strictly necessary.
9. Provide reproducible-build instructions or publish source-to-binary provenance so independent parties can validate the distributed artifacts.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises system control, file operations, application management, and system settings changes without any warning, scope limitation, or confirmation guidance. In an agent skill context, this can normalize impactful actions and increase the chance that users trigger destructive or privacy-sensitive operations without understanding the risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

All user-facing documentation in this skill file is presented in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.